lkml.org 
[lkml]   [2008]   [Jul]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 1/2] posix-timers: fix posix_timer_event() vs dequeue_signal() race
From
Date
On Wed, 2008-07-23 at 20:52 +0400, Oleg Nesterov wrote:
> The bug was reported and analysed by Mark McLoughlin <markmc@redhat.com>,
> the patch is based on his and Roland's suggestions.
>
> posix_timer_event() always rewrites the pre-allocated siginfo before sending
> the signal. Most of the written info is the same all the time, but memset(0)
> is very wrong. If ->sigq is queued we can race with collect_signal() which
> can fail to find this siginfo looking at .si_signo, or copy_siginfo() can
> copy the wrong .si_code/si_tid/etc.
>
> In short, sys_timer_settime() can in fact stop the active timer, or the user
> can receive the siginfo with the wrong .si_xxx values.
>
> Move "memset(->info, 0)" from posix_timer_event() to alloc_posix_timer(),
> change send_sigqueue() to set .si_overrun = 0 when ->sigq is not queued.
> It would be nice to move the whole sigq->info initialization from send to
> create path, but this is not easy to do without uglifying timer_create()
> further.
>
> As Roland rightly pointed out, we need more cleanups/fixes here, see the
> "FIXME" comment in the patch. Hopefully this patch makes sense anyway, and
> it can mask the most bad implications.
>
> Reported-by: Mark McLoughlin <markmc@redhat.com>

I've re-tested and can confirm that the patch fixes the test case at:

http://markmc.fedorapeople.org/test-posix-timer-race.c

Cheers,
Mark.



\
 
 \ /
  Last update: 2008-07-24 17:33    [W:0.133 / U:0.328 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site